Espcms V5.6.13.04.22 UTF8 正式版后台逻辑验证错误漏洞之2/N

简要描述： 系统后台权限逻辑校验存在问题，导致后台某模块功能被绕过和非授权访问 详细说明： 后台管理员权限校验在文件\public\classconnector.php: function adminpurview if $this-fun-accept'archive', 'R' == 'filemanage' && $this-fun-accept'action', 'R' == 'batupfilesave' $ecispadmininfo = $this-fun-accept'ecispadmininfo', 'G'; $esppowerlist =...

PT-2011-1822

Name of the Vulnerable Software and Affected Versions TYPO3 Commenting system Backend Module commentsbe extension versions 0.0.2 and earlier Description A SQL injection issue exists in the Commenting system Backend Module commentsbe extension for TYPO3, allowing remote attackers to execute...

CVE-2010-4887: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Commenting system Backend Module commentsbe extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...